[music]
Next is going to be 6to4 tunnels.
And the advantage to these is they're dynamic,
they're multi-point, so it will just build a tunnel with whoever
it needs to build a tunnel to.
The advantage is we're not going to be putting in a tunnel destination.
So the two previous examples we looked at,
the GRE and the IP6 IP are point-to-point.
You had a tunnel source.
You had a tunnel destination.
The tunnel comes up.
You exchange routing protocols, whatever.
Now as we go into 6to4 in ISATAP, I'm not going to say you can't run
routing protocols over this.
There are various methods, and tricks, and such to do so.
We're not going to go into that today because,
honestly, 6to4 and ISATAP, I don't think they're going to get used
very much in the real world.
As we move forward, we have MPLS, we have DMVPN which are both,
ultimately I think, better solutions.
But, we want to look at this anyway.
We don't want to leave anything out.
So we'll do 6to4 and ISATAP, but we're just going to use static routes
with these. I'm not going to get into all the tricks you can do to
get OSPF or EIGRP to come up over these.
And, of course, the problem with that is there's no destination.
That's what it comes into, is there's no destination.
So we can do it, it can be done, but I don't think it's really worth
going into a huge discussion on.
This is going to be using the same topology that we've been using
the whole time.
And once again, we'll go between R1 and R4,
and just going over to Switch 2.
Most of these other sites are for when we get into MPLS and DMVPN,
although we certainly could bring them in here if we wanted to.
And you'll see that this config can just be duplicated for multiple
sites. It's not a big deal.
Let's switch over to the command line, and once again we'll start
with router 1.
I have no config on this at all yet.
I took the tunnel out that we had on from previous labs.
We're going to say interface tunnel 0, and this is where the real
fun sort of begins.
Let's look at this first before we get too far.
Do Show IP Interface
brief. Because as we start configuring our tunnel,
what we need to know is what our egress interface is going to be.
In the last two sections I built the tunnel between loopbacks,
and we could do that here too.
It's just not nearly as much fun.
We're going to actually build this between our physicals.
That means that from router 1's perspective,
if you look back at the diagram, he's going to be going from FA 00.12,
and his address is 173.1.12.1.
This is just really where the fun begins.
Here we go. IPv6 address-- if you read the documentation they tell
you that 6to4 tunnels are supposed to use the 2002 address space.
Realistically speaking you could technically do whatever you want.
It doesn't really matter.
But you're supposed to, fine, we'll stick with that.
Here's where the fun comes in.
2002 is supposed to be the first 16 bits - great.
The next two fields, the next two fields are going to be in our case
AD01:C01. Translation of 173 is AD1.1.12.C.1,
so it's the IPv4 address of the underlying egress interface for the
tunnel has to be in bits 17 through-- ultimately it's going to be
48. Those next two fields need to be your IPv4 address converted
to hex. By the way in case you haven't figured it out yet,
that right there is the problem with these tunnels.
As we go through this, well, what's the good?
What's the bad?
Pros and cons - there's your con right there.
Who's going to go convert all your IPv4 address to hex?
I'll do it for you, you have my email address at the beginning of
the course. I'll be happy to do it for you.
I charge by the prefix though.
Just so you know.
No, seriously though, this is going to be a real pain.
And then just give it a host portion.
I honestly don't care what the rest of it is - something like /64,
fine. If you want to specify the link local address you can.
In this case it's not going to really matter.
Now we say, tunnel source, and you have to tie this to the interface
that we just did the IP.
It's FA 00.12, and tunnel mode IPv6 IP which is what we did in the
previous lesson, but we have to follow it up with 6to4 because this
is a 6to4 tunnel.
Now what that tells the router by setting the mode to IPv6IP 6to4
that tells him, okay, so here's the deal when a packet shows up since
I am a 6to4 tunnel I know that I'm going to get the tunnel destination
out of these fields right here.
Now I'm going to get back to that in a second.
Before I go any further though I want to go set up the tunnel on
the other side.
Let's go over to router 4 and say, interface tunnel 0,
probably want to say, Do Show IP Interface Brief,
so then we can say, tunnel source ins FA 0/0.34 tunnel mode is IPv6
IP 6to4. And the IPv6 address is 2002:,
and the translation on this one is also going to be ad01:.
But this one, the 34 translates to 2204.
So 22 for the 34, 4 for the 4, ::4 just to give them a host portion.
Okay, now that's all fine.
Here's the problem.
First off, you've got to get all traffic with a 2002 to go
to this tunnel.
I'm trying to think of the best way to explain the overall problem
here. Maybe the best way is just to bluntly shove it right at you.
That is the network portion on router 4.
His network portion has a 2204 in it.
On router 1, his network portion has AC01 in it.
These guys aren't on the same network.
We have two ends of a tunnel that are not on the same network.
When they designed the 6to4 tunnel, the idea was to embed the IPv4
address because again, what have I not typed,
even though the tunnel says up?
I never said tunnel destination.
Not once. Who is he supposed to build this tunnel to? That's what
we don't know. Where we're supposed to find out is out of these two
fields, that's great.
But here's the problem, they put it in the network portion instead
of the host portion it honestly should have probably been in the
host portion. We're going to talk about ISATAP in the next lesson
and that's what they did, they put it in the host portion.
But since it's in our network portion that means that we're now going to
have to manually push all the traffic for 2002 down the tunnel.
IPv6 route 2002::/16 to tunnel 0, and do the exact same thing on
router 4. We have to push all the 2002 traffic into the tunnel.
But that's not even enough, because our network is using 2001 and
such for the other locations.
So now we have to teach each side how to get to the subnets on the
other sides. Let's see, I'm on router 4 here?
Now I'm going to need IPv6 route to 2001 DB8:100:-- we'll say 7
::/64. Where does that go?
To tunnel 0. But here's the key to this whole thing.
This is the key to what makes 6to4 work right here.
Next hop 2002 AD01 C01::1 - router 1's tunnel address for the 6to4.
How does this work?
Very simple, here comes a packet to this router going to router 1's
loopback 1 interface. That's what that is in case you're not real
familiar looking at the diagram.
That's router 1's loopback 1 interface and I see it goes to tunnel
0 to this next-hop 2002.
Now this recursive look up is what puts the 2002 into the tunnel,
not to mention of course we're pushing it down tunnel 0.
But this right here is the magic, the router sees that in the next-hop,
sees that it's a 2002 address, and that it's a 6to4 tunnel,
and it goes, oh, so AD01:C01, that's the IPv4 address of the device
that I need to build the tunnel to.
That's your destination right there.
It pulls it out because he knows he's a 6to4 tunnel,
so it pulls it out of the next-hop from the routing protocol.
But I hope you can see why it makes it very difficult to run a dynamic
routing protocol over this.
I did not say impossible, I said difficult.
I could do BGP and instead of putting this IPv6 route,
I could've said neighbor 2002:AD01:C01::1.
I could use that for my neighborship, and that would tell me who
to build the tunnel to.
Okay, so the trick is, is that we're using that address,
the IPv6 address of the other side of the tunnel as the destination
for our frames.
That's all we need to do.
That's it. Now, it'd be nice if our switches,
and everybody, could learn about this.
We probably also want to follow up with IPv6 router EIGRP 100 redistribute
static metric.
Then we pretty much do the opposite on the other end.
We say IPv6 route 2001DBA:100:8::/64 out tunnel 0,
with a next-hop of 2002: and this one would be AD01:2204::4.
There we go. And if we've done our job correctly,
we should be able to go over to our switch and say to trace to 2001:DB8:100:8::8.
And there we go.
You can see right here how it's passing through the tunnel right
there, using those addresses.
Again, how did it learn the destination?
The destination is right there.
It's right out of the static route.
So, again, these work fine.
Like I said, dynamic routing is a little tricky over them.
Certainly, not impossible.
BGP's actually the easiest of them, to be honest with you.
But, there it is.
Static's, of course, easy.
Just redistribute the static then.
So, what are the advantages and disadvantages?
The advantage is it's dynamic.
I didn't have to put in a tunnel destination.:15:19.760000 But there it is. Static's of course easy. Just redistribute the static then. So what are the advantages and disadvantages? The advantage is it's dynamic. I didn't have to put in a tunnel destination. So if I had 400 remote sites, it would just mean 400 static routes with their next hop set appropriately. Now, obviously the huge downside would be while the 400 static routes, it's sort of a double edged sword there, right? But the point is you're not making 400 tunnel interfaces and 400 subnets and manually setting 400 destinations and all that. In a way, you sort of are through the routing. But that's why I said, you know, if you really have that many remote sites and you're going to use six to four tunnels, maybe BGP would be a really good way to do that. And just have it bring up BGP neighbor relationships and then do that. Or like I said, if you do a little bit of research, you'll find how to run various dynamic routing protocols over this. It's not easy. It's not clean. And believe me when I say there's better options anyway. But it is functional. It's here. It works. So, that's pretty much six to four tunnels. They work fine. They're just a little bit tedious with the configuration because you have to convert all the IPv4 addresses over to hacks. And again, that's really no fun.